Code Injection in Dassault Systèmes DELMIA Apriso (CVE‑2025‑6204) Enables Arbitrary Code Execution
What It Is – A code‑injection flaw in the DELMIA Apriso manufacturing‑operations platform allows an unauthenticated attacker to inject malicious code that the application will execute.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; no public exploit has been observed, but the CVSS score assigned by NVD is 8.8 (High), indicating a realistic risk of remote code execution.
Affected Products – Dassault Systèmes DELMIA Apriso (all supported versions at the time of disclosure).
Why It Matters for Trust & Control Assurance
- Application security controls – The flaw tests the effectiveness of your secure‑development lifecycle and vulnerability‑management processes, a core control objective that maps to many frameworks (e.g., NIST CSF Identify ID‑RM‑1).
- Evidence of remediation – Demonstrating timely patching and documented mitigation provides defensible audit evidence that your organization maintains a trusted posture.
- Supply‑chain confidence – Apriso is often a critical component of manufacturing execution; a breach would ripple through downstream partners, making continuous control monitoring essential for enterprise buyers.
Recommended Actions
- Apply Dassault Systèmes’ security patch for CVE‑2025‑6204 immediately.
- Update your vulnerability‑management inventory to flag this finding and assign remediation owners.
- Capture remediation evidence (patch version, deployment logs) and map the activity to the “application security” control objective in your framework of record.
- Conduct a focused penetration test on Apriso interfaces to confirm the fix.
Source: CISA KEV – CVE‑2025‑6204